Kubernetes網絡指南，雲原生時代的底層網絡模型、實現、企業落地選型推薦！

●目錄 章 夯實基礎：Linux 網絡虛擬化 11.1 網絡虛擬化基石：network namespace ············································.11.1.1 初識 network namespace ··················································.21.1.2 配置 network namespace ··················································.31.1.3 network namespace API 的使用 ···········································.61.1.4 小結 ·······································································.121.2 千呼萬喚始出來：veth pair ·······················································.121.2.1 veth pair 內核實現·························································.141.2.2 容器與 host veth pair 的關繫 ··············································.151.2.3 小結 ·······································································.171.3 連接你我他：Linux bridge ························································.171.3.1 Linux bridge 初體驗 ·······················································.171.3.2 把 IP 讓給 Linux bridge ···················································.211.3.3 將物理網卡添加到 Linux bridge ··········································.221.3.4 Linux bridge 在網絡虛擬化中的應用 ·····································.251.3.5 網絡接口的混雜模式 ·····················································.261.4 給用戶態一個機會：tun/tap 設備·················································.281.4.1 tun/tap 設備的工作原理···················································.281.4.2 利用 tun 設備部署一個 ··············································.291.4.3 tun 設備編程 ······························································.311.5 iptables·············································································.341.5.1 祖師爺 netfilter ····························································.341.5.2 iptables 的三板斧：table、chain 和 rule ··································.361.5.3 iptables 的常規武器 ·······················································.391.6 初識 Linux 隧道：ipip ····························································.451.6.1 測試 ipip 隧道 ·····························································.461.6.2 ipip 隧道測試結果復盤 ···················································.491.6.3 小結 ·······································································.501.7 Linux 隧道網絡的代表：VXLAN ················································.511.7.1 為什麼需要 VXLAN ······················································.511.7.2 VXLAN 協議原理簡介 ···················································.521.7.3 VXLAN 組網必要信息 ···················································.541.7.4 VXLAN 基本配置命令 ···················································.551.7.5 VXLAN 網絡實踐·························································.561.7.6 分布式控制中心 ··························································.631.7.7 自維護 VTEP 組 ··························································.631.7.8 小結 ·······································································.681.8 物理網卡的分身術：Macvlan·····················································.681.8.1 Macvlan 五大工作模式解析 ··············································.681.8.2 測試使用 Macvlan 設備 ···················································.721.8.3 Macvlan 的跨機通信 ······················································.731.8.4 Macvlan 與 overlay 對比 ··················································.741.8.5 小結 ·······································································.751.9 Macvlan 的救護員：IPvlan························································.751.9.1 IPvlan 簡介 ································································.751.9.2 測試 IPvlan ································································.771.9.3 Docker IPvlan 網絡 ························································.781.9.4 小結 ·······································································.78第 2 章 飲水思源：Docker 網絡模型簡介 792.1 主角登場：Linux 容器 ····························································.792.1.1 容器是什麼································································.792.1.2 容器與虛擬機對比 ························································.802.1.3 小結 ·······································································.812.2 打開萬花筒：Docker 的四大網絡模式 ···········································.812.2.1 bridge 模式 ································································.822.2.2 host 模式 ··································································.832.2.3 container 模式 ·····························································.842.2.4 none 模式··································································.852.3 常用的 Docker 網絡技巧 ·······················································.852.3.1 查看容器 IP ·······························································.852.3.2 端口映射 ··································································.862.3.3 訪問外網 ··································································.872.3.4 DNS 和主機名 ····························································.872.3.5 自定義網絡································································.882.3.6 發布服務 ··································································.902.3.7 docker link：兩兩互聯 ····················································.912.4 容器網絡的個標準：CNM···················································.932.4.1 CNM 標準 ·································································.932.4.2 體驗 CNM 接口 ···························································.942.4.3 Libnetwork·································································.952.4.4 Libnetwork 擴展···························································.972.4.5 小結 ·······································································.982.5 天生不易：容器組網的挑戰 ······················································.992.5.1 容器網絡挑戰綜述 ························································.992.5.2 Docker 的解決方案 ·······················································.1012.5.3 第三方容器網絡插件 ·····················································.1022.5.4 小結 ·······································································.1032.6 如何做好技術選型：容器組網方案沙場點兵 ····································.1032.6.1 隧道方案 ··································································.1042.6.2 路由方案 ··································································.1042.6.3 容器網絡組網類型 ························································.1062.6.4 關於容器網絡標準接口···················································.1072.6.5 小結 ·······································································.108第 3 章 標準的勝利：Kubernetes 網絡原理與實踐 1093.1 容器基礎設施的代言人：Kubernetes·············································.1093.1.1 Kubernetes 簡介 ···························································.1093.1.2 Kubernetes 能做什麼 ······················································.1113.1.3 如何用 Kubernetes ························································.1133.1.4 Docker 在 Kubernetes 中的角色 ··········································.1133.2 終於等到你：Kubernetes 網絡 ····················································.1143.2.1 Kubernetes 網絡基礎 ······················································.1143.2.2 Kubernetes 網絡架構綜述·················································.1153.2.3 Kubernetes 主機內組網模型 ··············································.1173.2.4 Kubernetes 跨節點組網模型 ··············································.1183.2.5 Pod 的 hosts 文件··························································.1203.2.6 Pod 的 hostname ···························································.1213.3 Pod 的核心：pause 容器 ··························································.1243.4 打通 CNI 與 Kubernetes：Kubernetes 網絡驅動··································.1313.4.1 即將完成歷史使命：Kubenet·············································.1313.4.2 網絡生態步：CNI ···················································.1333.5 找到你並不容易：從集群內訪問服務············································.1393.5.1 Kubernetes Service 詳解···················································.1413.5.2 Service 的三個 port························································.1453.5.3 你的服務適合哪種發布形式··············································.1463.5.4 Kubernetes Service 發現···················································.1503.5.5 特殊的無頭 Service ·······················································.1513.5.6 怎麼訪問本地服務 ························································.1533.6 找到你並不容易：從集群外訪問服務············································.1543.6.1 Kubernetes Ingress·························································.1553.6.2 小結 ·······································································.1573.7 你的名字：通過域名訪問服務 ···················································.1583.7.1 DNS 服務基本框架 ·······················································.1583.7.2 域名解析基本原理 ························································.1593.7.3 DNS 使用··································································.1613.7.4 調試 DNS··································································.1663.8 Kubernetes 網絡策略：為你的應用保駕護航 ····································.1673.8.1 網絡策略應用舉例 ························································.1683.8.2 小結 ·······································································.1723.9 前方高能：Kubernetes 網絡故障定位指南 ·······································.1733.9.1 IP 轉發和橋接·····························································.1733.9.2 Pod CIDR 衝突 ····························································.1753.9.3 hairpin ·····································································.1763.9.4 查看 Pod IP 地址 ··························································.1763.9.5 故障排查工具 ·····························································.1783.9.6 為什麼不推薦使用 SNAT ·················································.180第 4 章 刨根問底：Kubernetes 網絡實現機制 1834.1 豈止 iptables：Kubernetes Service 官方實現細節探秘 ···························.1834.1.1 userspace 模式·····························································.1844.1.2 iptables 模式·······························································.1864.1.3 IPVS 模式 ·································································.1914.1.4 iptables VS. IPVS ··························································.1984.1.5 conntrack ··································································.1994.1.6 小結 ·······································································.2004.2 Kubernetes 極客們的日常：DIY 一個 Ingress Controller·························.2014.2.1 Ingress Controller 的通用框架 ············································.2024.2.2 Nginx Ingress Controller 詳解 ·············································.2024.2.3 小結 ·······································································.2094.3 滄海桑田：Kubernetes DNS 架構演進之路 ······································.2094.3.1 Kube-dns 的工作原理 ·····················································.2094.3.2 上位的 CoreDNS ··························································.2124.3.3 Kube-dns VS. CoreDNS ···················································.2174.3.4 小結 ·······································································.2204.4 你的安全我負責：使用 Calico 提供 Kubernetes 網絡策略·······················.2204.4.1 部署一個帶 Calico 的 Kubernetes 集群 ···································.2214.4.2 測試 Calico 網絡策略 ·····················································.225第 5 章 百花齊放：Kubernetes 網絡插件生態 2285.1 從入門到放棄：Docker 原生網絡的不足·········································.2285.2 CNI 標準的勝出：從此江湖沒有 CNM ··········································.2295.2.1 CNI 與 CNM 的轉換 ······················································.2305.2.2 CNI 的工作原理···························································.2315.2.3 為什麼 Kubernetes 不使用 Libnetwork ···································.2355.3 Kubernetes 網絡插件鼻祖 flannel ·················································.2385.3.1 flannel 簡介································································.2395.3.2 flannel 安裝配置 ··························································.2415.3.3 flannel backend 詳解 ······················································.2445.3.4 flannel 與 etcd ·····························································.2565.3.5 小結 ·······································································.2575.4 大三層網絡插件：Calico ····················································.2575.4.1 Calico 簡介 ································································.2585.4.2 Calico 的隧道模式 ························································.2635.4.3 安裝 Calico ································································.2635.4.4 Calico 報文路徑 ···························································.25.4.5 Calico 使用指南 ···························································.2675.4.6 為什麼 Calico 網絡選擇 BGP ·············································.2725.4.7 小結 ·······································································.2745.5 Weave：支持數據加密的網絡插件 ···············································.2765.5.1 Weave 簡介································································.2765.5.2 Weave 實現原理···························································.2775.5.3 Weave 安裝································································.2785.5.4 Weave 網絡通信模型 ·····················································.2805.5.5 Weave 的應用示例 ························································.2825.5.6 小結 ·······································································.2885.6 Cilium：為微服務網絡連接安全而生 ············································.2885.6.1 為什麼使用 Cilium ························································.2895.6.2 以 API 為中心的微服務安全 ·············································.2945.6.3 BPF 優化的數據平面性能 ················································.2955.6.4 試用 Cilium：網絡策略···················································.2975.6.5 小結 ·······································································.2995.7 Kubernetes 多網絡的先行者：CNI-Genie ········································.2995.7.1 為什麼需要 CNI-Genie····················································.3005.7.2 CNI-Genie 功能速遞 ······················································.3025.7.3 容器多 IP ··································································.303第 6 章 Kubernetes 網絡下半場：Istio 3056.1 微服務架構的大地震：sidecar 模式 ··············································.3056.1.1 你真的需要 Service Mesh 嗎··············································.3066.1.2 sidecar 模式 ·······························································.3076.1.3 Service Mesh 與 sidecar ···················································.3076.1.4 Kubernetes Service VS. Service Mesh ·····································.3096.1.5 Service Mesh 典型實現之 Linkerd ········································.3106.2 Istio：新一代微服務架構潮流···············································.3126.2.1 Istio 簡介 ··································································.3126.2.2 Istio 安裝 ··································································.3136.2.3 Istio 路由規則的實現 ·····················································.3176.3 一切盡在不言中：Istio sidecar 透明注入·········································.3196.3.1 Init 容器 ···································································.3196.3.2 sidecar 注入示例 ··························································.3196.3.3 手工注入 sidecar ··························································.3266.3.4 自動注入 sidecar ··························································.3276.3.5 從應用容器到 sidecar 代理的通信········································.3296.4 不再為 iptables 腳本所困：Istio CNI 插件 ·······································.3306.5 除了微服務，Istio 還能做更多 ···················································.331

本書是容器與Kubernetes網絡的基礎和進階書籍，旨在讓更多人了解和學習雲原生時代的底層網絡模型與實現機制，指導企業在落地雲原生時的網絡方案選型。全書包括：容器網絡虛擬化基礎、Docker容器網絡、Kubernetes網絡和Istio網絡4部分，共6章。章容器網絡虛擬化基礎將支撐容器網絡的內核技術娓娓道來。第2章簡單介紹了Docker原生的容器網絡能力。Kubernetes網絡分為3章，第3章介紹Kubernetes網絡的基礎概念和使用，第4章為讀者剖析了Kubernetes網絡的底層實現原理，第5章詳解了業界主流的Kubernetes網絡插件。Istio網絡總共1章，重點解析Istio網絡流量管控的背後機制。本書適合作為高等院校計算機相關專業雲計算課程的參考資料，也適合雲計算從業者，特別是希望對雲原生網絡技術有較深入了解並希望將其應用到日常工作中的所有讀者閱讀。

杜軍 著

"自序緣起這些年來，我觀察到每次 Linux 世界的重大技術創新都發源於內核，經過一層層面向用戶的抽像和封裝，演化出應用層的森羅萬像。正所謂萬變不離其宗！我自認為是個“old school”（老派）的人，堅信維持這個世界運轉的、本質的那部分東西是不會輕易改變的。盡管新技術“亂花漸欲迷人眼”，但經歷過時間錘煉的實用技術和工具總是歷久彌新的。一個很好的例子便是傳統的網絡虛擬化和 BGP，它們就是在容器這個新瓶子裡煥發第二春的。因此，當有時髦的新技術出現時，我的反應是這些新技術底層是怎麼實現的，對那些看起來酷炫的功能反倒沒有興趣。正如 OpenStack 興起的那些年，當大家都在談論 nova、neutron 這類調度虛擬機和網絡的組件時，我默默地翻讀了內核虛擬機（KVM）的源碼。至今，我對那種奇妙的感覺記憶猶新，恰如一個發燒級攝影愛好者走進暗房，欣喜若狂地親自手洗一張可觸摸的膠片影等